In this lab, you will use the pre-configured Windows 11 device to view vulnerabilities in multiple ways, prioritize views to understand criticality, and then remediate several apps.   

The pre-configured Windows 11 device will be used for this lab because it is likely that the Windows Server device is still enrolling, installing apps, and syncing with CrowdStrike.  

By completing this lab, you will be able to: 

• Validate functionality of Windows devices and ensure that the devices are syncing with CrowdStrike. 
• Validate CrowdStrike integration. 
• View existing vulnerabilities by device, by vulnerability, and by product. 
• Determine criticality of vulnerabilities based on filters. 
• Step through remediation of several apps. 

Task 1 — Validate status of Windows 11 and Windows Server devices 

Task 2 -- Validate pre-configured CrowdStrike integration 

Task 3 — Vulnerability Defense familiarization 

Task 4 – Vulnerability remediation 

Based on the configuration steps from the previous lab, Windows Server will first enroll into Workspace ONE, then Falcon Sensor, Notepad++ and 7-Zip will be installed.  Windows Server validation will take a few minutes and may still be in progress when executing Step 2. 

However,we will first validate the Windows 11 device status.

1. On the ControlCenter VM ,in the top left corner of the Workspace ONE UEM console, click the down arrow in the OG Selector and validate that you are in the parent OG (Student lab.LabInstance.Id.)
2. Click Devices > Devices and click the Windows 11 device that appears on the list.  Note that this device was pre-enrolled, which is why it appears so quickly. 
3. Click the Apps tab in the middle of the screen.  Under the Managed Apps tab, you should see Notepad++, 7-Zip, and Falcon Sensor.   
4. If these apps do not appear on the list, go to the Summary tab and note the last Intelligent Hub check-in. If not done recently,log into the Win11 device and check whether the three applications have been installed. Right click the Intelligent Hub icon and select Sync to force Workspace ONE synchronization. 
5. Optionally, on the Windows 11 device, you can validate that Falcon Sensor is running by locating the bird arrow in the lower right corner. It should show a green checkmark to indicate the service is running.

Note: It’s probable that the Windows Server device will not complete enrollment and application installation within this timeframe. If that is the case, please complete this validation after the Vulnerability Defense exercises. 

1. On the ControlCenter VM, in the upper left corner, click the downward arrow that appears with your parent OG  and ensure that the account role shows as the ServerOG, which is the child OG that you created previously.  
2. Go to Devices > Devices and view the Windows Server device that you enrolled previously.
3. Note that Windows Server devices are identified by a server icon. 
4. On the right side of the screen, validate that the Enrollment column shows a green check box. 
5. Repeat steps #3 - #5 from above; however, please note that these deployments may still be in progress.

CrowdStrike Falcon must be integrated within the Workspace ONE UEM console in order to feed vulnerability data.  Once customer-specific data fields are entered, integration may take as much as 48 hours to complete. To save time in this lab environment ,CrowdStrike integration has already been pre-configured for you at the global level.   

Validate CrowdStrike integration 

1.      In the top left corner of the Workspace ONE UEM console, click the down arrow in the lilac box, and validate that you are in the parent OG. 

2.     To validate the configuration, go to Groups & Settings > Configurations > Go to Configurations and enter Vulnerability Defense in the search bar or scroll down to Vulnerability Defense on the list and click it. 

3.     This is where you would configure integration.  In this lab, you cannot view or modify the CrowdStrike integration because it has been configured within a higher level OG. You will see a yellow bar indicating that the provider configurations cannot be viewed at this OG level.   

This is because provider configurations are defined and stored at a specific OG and are not viewable from a child OG that only inherits them. 

Vulnerability Defense presents vulnerability data in an easy-to-digest dashboard.  By using filters and drilling down, pertinent vulnerabilities are surfaced. 

Because your Windows Server device has not yet fully integrated with CrowdStrike, all exercises in this lab are based on the pre-configured Windows 11 device. 

Note that the following key data points are presented: 

• Vulnerability ID: This is the CVE assigned to the vulnerability. 
• ExPRT.AI Rating: This is the rating provided via the CrowdStrike feed. 
• Vulnerability Type: Operating System or application 
• Known Exploited Status: This is from the CISA KEV feed. 
• CVSS Rating: This is the quantified severity based on an extensive algorithm. 

Become familiar with the vulnerability data by vulnerability and by product 

Vulnerability data can be viewed in three ways: by vulnerability, by product and by device.

1. From the parent OG go to Devices > Devices and select the Windows 11 device as identified by the Windows logo. 
2. In the List View screen, select the Vulnerabilities tab and view the data presented. 
3. On the right side of the screen, click Filters and select one or more filters and click Apply at the bottom of the screen.  View the presented data. 
4. Go to Security > Vulnerability Defense to open Vulnerability Defense.  Note the Total Vulnerabilities and scroll through the list of individual vulnerabilities.  Note the number of vulnerabilities listed. 
5. Click Filters on the right side of the screen and expand each of the options.  Under CVSS Rating, select Critical and High and then Apply.  You may also wish to select other filters.  Note that the resulting number of filtered vulnerabilities is a subset of the total vulnerabilities.  Depending on your company security mandates, it is likely that business and technical decisions will mandate which vulnerabilities will be remediated. 
6. Click the Vulnerable Products tab on the right half of the screen.  Note the Total Vulnerable Products and scroll through the list of vendors and products.  Click Filters on the right side of the screen and expand each of the options.  Under Product Type, select Application and then Apply. 
7. Click on 7-Zip and then click the CVE-2026-58052 vulnerability. Read the information presented.  Click the back button twice to return to the Vulnerability Defense dashboard. 

As you will see within the following steps, remediating vulnerabilities is straightforward. 

Step 1 – Remediate Notepad++ on Win11 device 

1. Click Notepad++ and scroll through the vulnerability presented.
2. Click the CVE-2026-48800. Read through the Vulnerability Summary. From the right side of the screen, click the NVD link.  Note that the concise summary presented within Vulnerability Defense is shorter than the NVD information. 
3. Click the radio button next to Notepad++ and note that the Set Up Remediation button turns purple and a recommendation appears to upgrade the application. 
4. Click Set Up Remediation.   
5. Review the options presented in the Select Resolving Product screen and find the option that shows the App Source as Enterprise App Repository.  Select Import. 
6. When the Enterprise App Repository opens, select Notepad++.   
7. Select the carat (v) dropdown and select the latest version, ensuring the architecture is x64, installer type set to MSI, and language is en-US.  Click Next. 
8. Within the UEM Application Configuration screen, scroll down to 'Automatic Updates' and enable.  Also enable Inherit Application Assignments.  Change Update Cadence to Weekly, and set to Every 1 Week on Thursday..  Note that Windows Desktops are not as sensitive to changes as Windows Servers,so this setting should be enabled cautiously. Click Save. 
9. After the Summary screen completes, the Distribution screen is presented. 
10. Designate the Assignment Name as Notepad++ EAR Distribution and create a description if desired.  
11. Change Deployment begins to yesterday's date.
12. Select to whom do you want to assign this app and select Student@lab.LabInstance.Id where the eight digit number represents your student instance.
13. Within App delivery method, change to Auto.
14. Towards the bottom of the screen, note the two options to Keep Application on Device.  View the related informational verbiage, which shows that the default for Windows Server differs from Windows Desktops.  For Windows Server, the app is retained, whereas for Windows Desktop, it is not.   
15. Accept all other options and select Create.
16. Click Save and Publish.

Step 1 – View Windows 11 vulnerabilities and remediate. 

1. In the top left corner of the Workspace ONE UEM console, click the down arrow in the lilac box, and change to the parent OG. 
2. Go to Devices > Devices and select the Win11 device. 
3. Select the Vulnerabilities tab.   
4. In the search vulnerability name field enter CVE-2026-58052 to find the 7-Zip vulnerability that you encountered earlier.
5. Select it and review the vulnerability summary. 
6. iiClick the radio button next to 7-Zip and note that the Set Up Remediation button turns purple and a recommendation appears to upgrade the application. 
7. Click Set Up Remediation.   
8. Review the options in the Select Resolving Product screen and find the option that shows the App Source as Enterprise App Repository and the version as 26.03. Select Import. 
9. When the Enterprise App Repository opens, select 7-Zip.   
10. Select the carat (v) dropdown and select the latest version.Confirm the following settings : Architecture: X64 , Installer type: MSI Language: en-US.  Click Next. 
11. Within the UEM Application Configuration screen,accept all defaults and click Save.
12. In the Deployment Method field, select Phased Deployment.
13. In the Target Assignment Groups field, select Student@lab.LabInstance.Id and Student@lab.LabInstance.Id Devices and click Save.
14. Locate the first phase box and in the Enter Phase Name box, enter Phase 1 in the Phase Target field, click Select Assignment Groups to target and select Student lab.LabInstance.Id from the dropdown.
15. Select Manual Progression.
16. Select Automatic Progression.
17. In the Install Rate box, enter 100.
18. Click the blue box to the right of the Wait Time field which causes that rule to be nullified.
19. Click Save in the upper right corner.
20. Set Deployment Begins to yesterday's date
21. Towards the bottom of the screen, note the two options to Keep Application on Device. Although the default would remove the app for Windows Desktop devices, set these settings to Disabled.
22. Click Create.
23. In the Assignment screen, click Save.
24. Click Publish.

Two vulnerabilities have now been remediated. It will take some time for CrowdStrike  reporting to complete. Nonetheless, you will walk through the validation steps.

Step 1 – Check dashboard for vulnerability status. 

1. To verify Notepad++ remediation, go to Security>Vulnerability Defense and enter CVE-2026-48800 in the Search vulnerability identifier box to find the status of the Notepad++ vulnerability. If the vulnerability has been remediated and all systems have sync'd, it should disappear from the screen.  

2. Likewise, the 7-Zip remediation should be complete.  To verify, go to Security > Vulnerability Defense > and enter CVE-2026-58052 in the Search vulnerability identifier box to find the status of the 7-Zip vulnerability. If the vulnerability has been remediated and all systems have sync’d, it should disappear from the screen.   

Note: Although you have remediated two vulnerabilities by your actions, it will take a short while for the applications to update and cease reporting the respective vulnerabilities. The lab environment that you have been provided does not allocate sufficient time for these processes to update and report, but in actual UAT and production environments, you would be able to confirm that these vulnerabilities are no longer present.

This completes the Windows Server/Vulnerability Defense lab.